AI warfare, cybersecurity and international regulation

On 19 September 2025, an Emirates flight to Dubai sat on a San Francisco tarmac for three hours while its passengers — many of them Indian engineers on H-1B visas — scrambled to work out whether they would be allowed back into the United States. Hours earlier, President Trump had signed a proclamation imposing a $100,000 fee on new H-1B petitions, a visa programme in which Indians make up roughly seven in ten recipients. A year, three court rulings and one appeals-court rebuff later, the fee remains blocked — a federal appeals court in Boston refused in July to reinstate it — but the very proclamation that created it lapses this week, on its first anniversary, unless the administration renews it. Nobody, least of all the engineers whose travel plans it upended, knows what happens next.
That chaos on the tarmac was never really about visa paperwork. It was one skirmish in a much larger, quieter contest: a global race over who gets to recruit, train and retain the relatively small number of people who can build and defend advanced digital systems. Nations that once fought over oil fields and factory floors are now fighting over résumés.
Consider the scale of the shortfall. ISC2's 2025 Cybersecurity Workforce Study, based on more than 16,000 professionals worldwide, found that 59% of organisations now report a “critical or significant” skills shortage — up sharply from 44% a year earlier — with AI topping the list of hardest-to-find skills. India's version of the story is starker still. Mint reported this year that the country has roughly 350,000 cybersecurity professionals guarding banks, power grids and government systems against demand for close to a million, while the Data Security Council of India recorded AI-linked threat detections rising from 13 million to 54 million events between 2022 and 2024. Attackers are scaling with software. Defenders are not.
Where money can buy talent, it is being spent with an abandon that would embarrass a transfer-window football agent. Meta has reportedly offered compensation packages worth up to $300 million over four years to pull researchers away from OpenAI and Google, and OpenAI's Sam Altman has said Mark Zuckerberg personally dangled nine-figure signing bonuses at his staff. That kind of money can buy perhaps a hundred frontier researchers worldwide — not the hundreds of thousands of hands-on engineers actually keeping hospitals, banks and utilities safe from ransomware. The AI talent war and the cybersecurity staffing crisis are two ends of the same broken pipeline: absurdly overpaid at the very top, chronically understaffed everywhere else.
Governments have noticed, and increasingly they are treating talent the way they once treated uranium or fighter jets: as something to be controlled at the border. Washington has just made hiring a large slice of the world's most reliable AI talent pool prohibitively expensive. Beijing, having spent years restricting chip and model-weight exports, is now reportedly weighing whether the same logic should extend to people — regulators are said to be treating the departure of a key AI researcher to a foreign rival as a security matter rather than simply a corporate one, alongside new curbs on overseas access to Chinese-built model weights and training data. People, in other words, are being folded into an export-control regime built for hardware.
India sits in an odd spot in all this: simultaneously the world's largest exporter of the talent Washington now wants to tax, and one of the most talent-starved markets for defending its own digital backbone. Every engineer lured abroad by pay no domestic employer can match is a person not building India's own cyber defences. Talent management, once a back-office HR function, has quietly become a matter of national infrastructure — as strategic as ports or power plants.
A reasonable counter-view says this is simply the market working as intended: countries can protect domestic jobs, firms can pay what a talent auction demands, and rising salaries should eventually pull more students into these fields on their own. There is some truth here — money is a real signal. But two things undercut it. The shortage that actually threatens critical infrastructure isn't at the $200-million tier; it sits in mid-level, hands-on operational roles that take years, not signing bonuses, to build — a joint DSCI-SANS study found that 84% of Indian organisations take one to six months to fill a single cybersecurity opening, mainly because candidates lack the practical experience no pay rise can manufacture overnight. And protectionist controls have a well-worn habit of backfiring: years of American chip export bans meant to slow China's AI progress instead accelerated Beijing's drive for chip self-sufficiency. A visa fee can redirect where talent goes. It has never, historically, made more of it exist.
None of this argues for inaction — quite the opposite. If talent is now a strategic resource, every stakeholder needs to manage it like one. Companies should invest in structured apprenticeships and hands-on “cyber range” training instead of only outbidding rivals for the same small pool of ready-made experts. Universities must close the well-documented gap between certificates and real capability by embedding hands-on labs and industry-set projects into degrees, rather than relying on theory-only semesters. Policymakers should fight this battle with a national AI-and-cybersecurity skilling mission — funded with the urgency of the India Semiconductor Mission — instead of leaning only on visas and export licences. And students weighing careers today should note that this shortage is forecast to persist to 2030, and that the real opportunity lies not in chasing the rare frontier-AI research job, but in the vast, under-supplied middle of security operations, cloud defence and AI-governance roles.
The next major contest over technology may be decided less by who owns the sharpest chip or writes the strictest export ban, and more by who has quietly built the deepest bench of people able to design, defend and govern these systems. Chips can be stockpiled and laws rewritten overnight; skilled people cannot be manufactured on demand. Every year spent treating talent as a line item rather than a national asset is a year handed, for free, to whichever country understood that first.